I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (,,, I am using VirtualBox and running a Kali Linux VM with a native Windows 7 computer. The network options in the Kali Linux VM are set as NAT by default. Using ifconfig, I found that my Kali Linux VM is I tried using

nmap -A -F [IP ADDRESS]

where "IP ADDRESS" includes the 3 other ip's above. However, they all reference to the same computer, which is my native Windows 7 computer which I am running VirtualBox on. Any ideas on why 3 IP's are associated with one device? Thank you for your help.

EDIT: Yet when I run the command:

xprobe2 [IP ADDRESS]

in kali linux, it says that all of the hosts are most likely linux....

  • I think it has to do with the fact that you are running Kali from a VM, and the way the VM adapter works. Could you try the live version (boot from USB/CD)? – Synthetica Feb 2 '14 at 9:26
  • Can you edit the full nmap output into your question? – user10211 Feb 2 '14 at 9:59

This is explained in the Virtualbox manual. Since your VM is a Virtual Machine, it runs on hardware that does not actually exist, and sees a network containing equally virtual other nodes. The manual above contains the following:

In NAT mode, the guest network interface is assigned to the IPv4 range 10.0.x.0/24 by default where x corresponds to the instance of the NAT interface +2. So x is 2 when there is only one NAT instance active. In that case the guest is assigned to the address, the gateway is set to and the name server can be found at

And a few lines later:

For network booting in NAT mode, by default VirtualBox uses a built-in TFTP server at the IP address

So the IP addresses that the guest VM sees as, and are addresses for virtual nodes that Virtualbox maintains on the virtual network to which the guest VM believe that it is connected; the guest VM itself is awarded IP address on that network.

All of this happens within the entrails of Virtualbox; the host operating system (Windows 7) is completely unaware of it. When the guest VM sends an IP packet with target address (for instance), the packet is sent on the virtual network interface: the guest VM sends an I/O request on that "hardware" (with an out opcode); the opcode triggers a CPU exception trapped with Virtualbox, which then sees the packet contents (they are in RAM) and acts as if a network interface really existed. From the packet contents, Virtualbox notices that it is meant for one of its virtual nodes, and computes a response packet, puts it in the RAM buffer that corresponds to the buffer for the virtual network interface of the guest, and triggers an interrupt request for the guest, there again as if there really was a network card able to warn the guest CPU about incoming data. Everything about virtual machines and emulation is smoke and mirrors, and this includes the whole virtual network that the guest VM is part of.

From the point of view of that Windows, there is only a process (Virtualbox) which possibly issues network-related system calls; the 10.0.2.x addresses are invisible to it.


Apart from virtualization, there is a concept of bonding networking interfaces in linux. The idea is to aggregate multiple network interfaces into a single virtual interface, effectively combining the bandwidth into a single network connection. There are actually six different mode in which we can utilize multiple network interfaces i.e.

  1. active-backup
  2. balance-xor
  3. broadcast
  4. 802.3ad
  5. balance-tlb
  6. balance-alb

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.